IPsec动态模式实验文档

IPsec动态模式实验
拓扑图：
*
实验环境描述：R4与R1之间使用OSPF，R1、R2、R3均使用静态路由，R2、R5之间，R3、R6之间使用RIPv2；R1与R3之间的链路为捆绑链路。*

R1:
crypto isakmp policy 1
 encr 3des
 hash md5
 authentication pre-share
crypto isakmp key 123456 address 0.0.0.0        
!
crypto ipsec transform-set myset esp-3des esp-md5-hmac 
 mode tunnel
!
crypto dynamic-map dymymap 5
 set transform-set myset 
!
crypto map mymap 10 ipsec-isakmp dynamic dymymap 
!
interface Loopback0
 ip address 1.1.1.1 255.255.255.255
!
interface Multilink1
 ip address 13.1.1.1 255.255.255.0
 ppp multilink
 ppp multilink group 1
 crypto map mymap
!
interface Ethernet0/0
 ip address 14.1.1.1 255.255.255.0
!
interface Serial1/0
 ip address 12.1.1.1 255.255.255.0
 serial restart-delay 0
 crypto map mymap
!
interface Serial2/0
 no ip address
 encapsulation ppp
 ppp multilink
 ppp multilink group 1
 serial restart-delay 0
!
interface Serial2/1
 no ip address
 encapsulation ppp
 ppp multilink
 ppp multilink group 1
 serial restart-delay 0
!
router ospf 10
 router-id 1.1.1.1
 redistribute static metric-type 1 subnets
 network 1.1.1.1 0.0.0.0 area 0
 network 14.1.1.1 0.0.0.0 area 0
!
ip route 5.5.5.5 255.255.255.255 12.1.1.2
ip route 6.6.6.6 255.255.255.255 13.1.1.3
ip route 25.1.1.0 255.255.255.0 12.1.1.2
ip route 36.1.1.0 255.255.255.0 13.1.1.3
ip route 194.10.0.0 255.255.0.0 12.1.1.2
ip route 195.10.0.0 255.255.0.0 13.1.1.3

R2:
crypto isakmp policy 1
 encr 3des
 hash md5
 authentication pre-share
crypto isakmp key 123456 address 12.1.1.1       
!
crypto ipsec transform-set myset esp-3des esp-md5-hmac 
 mode tunnel
!
crypto map mymap 10 ipsec-isakmp 
 set peer 12.1.1.1
 set transform-set myset 
 match address 101
!
interface Loopback0
 ip address 2.2.2.2 255.255.255.255
!
interface Ethernet0/0
 ip address 25.1.1.2 255.255.255.0
!
interface Serial1/0
 ip address 12.1.1.2 255.255.255.0
 serial restart-delay 0
 crypto map mymap
!
router rip
 version 2
 network 2.0.0.0
 network 25.0.0.0
 default-information originate
 no auto-summary
!
ip route 0.0.0.0 0.0.0.0 12.1.1.1
!
access-list 101 permit ip 194.10.10.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 101 permit ip 194.10.20.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 101 permit ip 194.10.30.0 0.0.0.255 192.168.0.0 0.0.255.255

R3:
crypto isakmp policy 1
 encr 3des
 hash md5
 authentication pre-share
crypto isakmp key 123456 address 13.1.1.1       
!
crypto ipsec transform-set myset esp-3des esp-md5-hmac 
 mode tunnel
!
crypto map mymap 10 ipsec-isakmp 
 set peer 13.1.1.1
 set transform-set myset 
 match address 101
!
interface Loopback0
 ip address 3.3.3.3 255.255.255.255
!
interface Multilink1
 ip address 13.1.1.3 255.255.255.0
 ppp multilink
 ppp multilink group 1
 crypto map mymap
!
interface Ethernet0/0
 ip address 36.1.1.3 255.255.255.0
!
interface Serial2/0
 no ip address
 encapsulation ppp
 ppp multilink
 ppp multilink group 1
 serial restart-delay 0
!
interface Serial2/1
 no ip address
 encapsulation ppp
 ppp multilink
 ppp multilink group 1
 serial restart-delay 0
!
router rip
 version 2
 network 3.0.0.0
 network 36.0.0.0
 default-information originate
 no auto-summary
!
ip route 0.0.0.0 0.0.0.0 13.1.1.1
!
access-list 101 permit ip 195.10.10.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 101 permit ip 195.10.20.0 0.0.0.255 192.168.0.0 0.0.255.255
access-list 101 permit ip 195.10.30.0 0.0.0.255 192.168.0.0 0.0.255.255

R4:
interface Loopback0
 ip address 4.4.4.4 255.255.255.255
!
interface Loopback1
 ip address 192.168.10.254 255.255.255.0
!
interface Loopback2
 ip address 192.168.20.254 255.255.255.0
!
interface Loopback3
 ip address 192.168.30.254 255.255.255.0
!
interface Loopback4
 ip address 192.168.40.254 255.255.255.0
!         
interface FastEthernet0/0
 ip address 14.1.1.4 255.255.255.0
 duplex auto
 speed auto
!
router ospf 10
 router-id 4.4.4.4
 log-adjacency-changes
 network 4.4.4.4 0.0.0.0 area 0
 network 14.1.1.4 0.0.0.0 area 0
 network 192.168.10.0 0.0.0.255 area 0
 network 192.168.20.0 0.0.0.255 area 0
 network 192.168.30.0 0.0.0.255 area 0
 network 192.168.40.0 0.0.0.255 area 0

R5:
interface Loopback0
 ip address 5.5.5.5 255.255.255.255
!
interface Loopback1
 ip address 194.10.10.254 255.255.255.0
!
interface Loopback2
 ip address 194.10.20.254 255.255.255.0
!
interface Loopback3
 ip address 194.10.30.254 255.255.255.0
!
interface FastEthernet0/0
 ip address 25.1.1.5 255.255.255.0
 duplex auto
 speed auto
!
router rip
 version 2
 network 5.0.0.0
 network 25.0.0.0
 network 194.10.10.0
 network 194.10.20.0
 network 194.10.30.0
 no auto-summary

R6:
interface Loopback0
 ip address 6.6.6.6 255.255.255.255
!
interface Loopback1
 ip address 195.10.10.254 255.255.255.0
!
interface Loopback2
 ip address 195.10.20.254 255.255.255.0
!
interface Loopback3
 ip address 195.10.30.254 255.255.255.0
!
interface FastEthernet0/0
 ip address 36.1.1.6 255.255.255.0
 duplex auto
 speed auto
!
router rip
 version 2
 network 6.0.0.0
 network 36.0.0.0
 network 195.10.10.0
 network 195.10.20.0
 network 195.10.30.0
 no auto-summary

注意：必须触发流量，Peer关系才会建立，而且需从分部ping总部（带源）
验证：

总结：在R2、R3上面配置关于IPsec的ACL时，必须匹配明细流量，否则IPsec不会触发成功。